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FOREWORD 


By Robert E. David 
Staff Officer 
Transportation Research Board 


ACRP Report 1: Safety Management Systems for Airports, Volume 1: Overview, explains 
what a safety management system (SMS) is and how a systems approach to safety manage- 
ment will benefit both the safety and business aspects of airports. The implementation of 
SMS represents a change in the safety culture of an organization. In this regard, airport 
directors and members of their governing boards will find this document particularly use- 
ful since the successful implementation of SMS is dependent on the commitment of the 
highest levels of management. 


This report provides a brief description of a safety management system (SMS) and is 
intended to be an easy-to-read, quick introduction to SMS for airport directors and their 
governing boards. It describes the advantages associated with instituting such a system and 
explains the four components or pillars (safety policy, safety risk management, safety assur- 
ance, and safety promotion) that are part of an SMS. The report also provides background 
information on the International Civil Aviation Organization’s requirements for SMS at air- 
ports and relates the experiences of airports located outside the United States in implement- 
ing SMS. 

Although the concept of safety management systems has been around for several years, it 
is relatively new to airports. The good news for U.S. airport operators is that many of the pro- 
cedures and practices that they have been using to comply with the current requirements of 
Title 14 Code of Federal Regulations Part 139 will provide the basis for establishing an SMS. 

It was not intended that this overview explain how SMS will be incorporated into the Part 
139 regulation. The Federal Aviation Administration (FAA) is considering several different 
options on how SMS will be implemented at U.S. airports. Section 6 of this report provides 
their current thinking on this subject but also recognizes that the FAA is conducting a pilot 
program with several U.S. airports on SMS implementation. Undoubtedly, FAA’s final pro- 
posal will reflect the knowledge gained from the experiences of airports participating in the 
pilot program. 

The MITRE Corporation’s Center for Advanced Aviation System Development (CAASD) 
prepared this SMS overview for TRB under ACRP Project 11-02/Task 4. CAASD has a long 
history in aviation safety-related projects and has provided support to both the FAA and 
international aviation organizations in SMS development and implementation. 

Readers are advised that this overview is the first step that ACRP is undertaking regard- 
ing SMS. The second step is to develop for airport operators a Guidebook for Airport Safety 
Management Systems under ACRP Project 04-05. This guidebook will provide detailed 
information on how to develop SMS at an airport. This guidebook is expected to be com- 
pleted in the last quarter of 2008 and published as Volume 2 of this report in 2009. 
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Purpose of This Document 


This document introduces the application of Safety Management Systems (SMS) to airport operations. It 

is a resource intended for U.S. airport executives, managers, and safety officials and is a companion 
document to the Guidebook for Airport Safety Management Systems, which will be developed under ACRP 
Project 4-05. The guidebook will be published as ACRP Report 1, Volume 2. 


This overview of SMS describes how a systems approach to safety management will benefit both the 
safety and business aspects of airport operations. It describes the essential components of SMS and also 
introduces the International Civil Aviation Organization (ICAO) mandate and anticipated Federal Aviation 
Administration (FAA) policy for airport SMS. Furthermore, it includes valuable lessons learned from case 
studies in SMS implementation efforts at various airports and in other industries. 


It should be noted that at the time this overview goes to press, the FAA has not finalized all of its policies 
and plans for the implementation of SMS for airports. The Guidebook and future FAA guidance material 
are expected to provide further details. 
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Introduction 


Why Safety Management Systems? 


Historically, aviation safety has been built upon the reactive analysis of past accidents and the introduction of 
corrective actions to prevent the recurrence of those events. With today’s extremely low accident rate, it is 
increasingly difficult to make further improvements to the level of safety by using this approach. Therefore, a 
proactive approach to managing safety has been developed that concentrates on the control of processes rather 
than solely relying on inspection and remedial actions on end products. This innovation in aviation system 
safety is called a Safety Management System (SMS), an expression indicating that safety efforts are most 
effective when made a fully integrated part of the business operation. 


It is now generally accepted that most aviation accidents result from human error. It would be easy to conclude 
that these errors indicate carelessness or incompetence on the job, but that would not be accurate. Investi- 
gations are finding that the human is only the last link in a chain that leads to an accident. These accidents 
will not be prevented by merely changing people; 

increased safety can only occur when the underlying 

causal factors are addressed. 


Enhancing overall safety in the most efficient manner 
requires the adoption of a systems approach to safety 
management. Every segment and level of an organi- 
zation must become part of a safety culture that 
promotes and practices risk reduction. 


Safety management is based on the premise that there 
will always be safety hazards and human errors. SMS 
establishes processes to improve communication about 


these risks and take action i minimize them. This , There will always be hazards and risks in the airport envi- 
approach will subsequently improve an organization’s —_onment. Proactive management is needed to identify and 
overall level of safety. control these safety issues before they lead to mishaps. 


© John Alexanders 
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Section 1 


System Safety and the Benefits of 
Safety Management Systems 


System Safety and SMS 


System safety is the application of engineering and management principles, criteria, 
and techniques to achieve an acceptable level of safety throughout all phases of a 


system. 


Achieving this definition of system safety is the primary objective of SMS. A 
well-structured SMS provides a systematic, explicit, and comprehensive process 
for managing risks. This process includes goal setting, planning, documentation, 
and regular evaluation of performance to ensure that goals are being met. 


Today’s U.S. aviation industry has achieved a remarkably high 
level of safety. Maintaining this success will prove challenging 
as air traffic increases. FAA projections anticipate 1.4 million 
additional domestic takeoffs and landings each year from 2007 
until 2020. This changing aviation environment will therefore 
require an even more effective approach to reducing risk. 


A Safety Management System (SMS) is a formal, top-down 
business-like approach to managing safety risk that is built 
on basic system safety principles. This section describes 
those principles, outlines the differences between SMS and 
traditional approaches to safety, and details the benefits to 
be gained from SMS implementation. 

SMS PROVIDES 

A SYSTEMATIC, 
EXPLICIT, AND 
COMPREHENSIVE 
PROCESS FOR 


MANAGING RISKS. 
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SMS includes several key system safety principles as shown below: 


%* Management commitment to safety 


Because the attitudes and actions of management can significantly 
influence the entire staff, it is therefore critical that these leaders commit 


to the success of an SMS implementation. 


& Proactive identification of hazards 


Early identification and reporting of hazards can save a significant 


amount of time and resources down the road. 


% Actions taken to manage risks 


A system must be in place to determine logical approaches to counteract 


known risks to safe operation. 


% Evaluation of safety actions 


An ongoing evaluation of the impacts of risk management actions is 
necessary to determine if further remedial activities are required. 


Differences from Traditional Safety Approach 


Most of these principles exist in some form in current safety systems. 
SMS is not intended to be a new safety management system; rather it 


anticipate safety risks. 


SMS spreads responsibility for safe operations throughout all levels and 
segments of the organization. This increase in the number of people watching 
for safety issues makes it less likely that a hazard will go undetected and 
possibly lead to an accident. This is depicted in Figure 1.1, where each “slice’ 
represents a different segment or layer of the organization. In the diagram, 

a generic organization is represented by four segments—in an airport 

setting, this could include such groups as facilities, operations, safety, and 
management. Each SMS implementation will have its own customized set of 
layers that coordinate to create the safety culture of SMS. Each slice has holes 
that symbolize the potential for a safety hazard to go unnoticed, because the 
layer does not deal with that type of hazard, or due to human error. However, 


b 


builds upon an organization’s existing safety processes. However, 

there are a number of ways in which SMS differs from the traditional 
approaches. One of the key differences is that SMS takes a proactive 
approach to safety management—it goes beyond prescriptive audits and 
checklist-based inspections to develop procedures and indicators that 


SMS SPREADS 
RESPONSIBILITY FOR 
SAFE OPERATIONS 
THROUGHOUT ALL 
LEVELS OF THE 


ORGANIZATION. 
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when these layers are unified by SMS principles, it becomes less likely that a hazard makes it through all the 
levels without being identified and mitigated. 


Safety Incident 


Hazard Hazards 


Figure 1.1: SMS Layers (Adapted from James Reason, Human Error, 
Cambridge University Press [1990]) 


SMS has much in common with Quality Management (or Quality Assurance) systems in that they both 
require planning, performance monitoring, communication, and the participation of all employees. Moreover, 
SMS recognizes that human and organizational errors can never be entirely eliminated and seeks to reduce 
them by developing a safety-oriented culture. This kind of environment focuses on eliminating hazardous 
conditions before they can become something more serious. 


It is important to note that implementing SMS does not involve imposing an additional layer of oversight or 
regulations on the organization. Rather, it is an organizational shift that is seamlessly integrated into the 
routine day-to-day operations. 


Benefits of SMS 


Clearly, the ultimate goal of SMS is increased safety—in particular, fewer accidents and injuries. Moreover, 
increasing a system’s level of safety leads to reduced material losses and enhances productivity. This makes 
the case that safety is good for business. 


Some further benefits include: 


™ Reduction of the direct and indirect costs of accidents 


— Fines, repair costs, damage claims, and increased insurance premiums are a few of the potential 
economic consequences of an airport mishap. 


“ Improved employee morale and productivity 


— Promoting communication between management and the rest of the organization prevents 
disenfranchisement and lifts morale. 
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Establishing a marketable safety record 

— A record of consistently safe operations can be used to attract new 

business and investment. 

Logical prioritization of safety needs 

— SMS emphasizes risk mitigation actions that provide the biggest 
impact on both safety and the bottom line. 

Compliance with legal responsibilities for safety 


— Airport certification requirements mandate a number of 
safety processes and standards that can be included in an 
organization’s SMS. 


More efficient maintenance scheduling and resource utilization 


— Effective hazard reporting in SMS allows proactive scheduling of 
maintenance tasks when resources are available, increasing the 
likelihood that maintenance is performed on time and more 
efficiently. 


Avoiding incident investigation costs and operational disruptions 


— Improved communication and risk mitigation will prevent many 
accidents from ever occurring. 


Continuous improvement of operational processes 


“A safety management system 
necessitates a cultural change 
in an organization so that the 
safety of operations is the 
objective behind every action 
and decision by both those 
who oversee procedures and 
those who carry them out. The 
system leads to standardized 
and unambiguous procedures 
for each crewmember, during 
both routine and emergency 
operations. Duties and 
responsibilities are specified 
for each staff member and for 
standard and emergency 
operations. Supervisory and 
subordinate chains of 
command are also delineated.” 
—RMark Rosenker, chairman 
of the National Transportation 
Safety Board 


— SMS allows for lessons learned to be incorporated into the system and lead to superior operations. 


Finally, ICAO and the FAA have announced or proposed 


requirements or plans to implement safety management systems for 
air traffic services, airline oversight, and airports. This demonstrates 
their confidence in the safety management capabilities of SMS. 
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Section 2 


The Components of SMS 


Every SMS implementation is based on four primary components, or pillars, as shown in Figure 2.1. This 
section describes how each one contributes to improving safety and briefly details the activities that make up 
each pillar. 


SAFETY MANAGEMENT SYSTEM 


SAFETY POLICY | SAFETY RISK 
MANAGEMENT 


e Hazard Identification 


e Policy Statement 


e Organizational Structure 


By Gcedires e Risk Assessment 


e Risk Mitigation and 
Tracking 


e Internal Audits 


e External Audits e Training 


e Corrective Action | e Communication 


Figure 2.1: The Pillars of SMS 


Safety Policy 


SMS will only be effective when a Safety Policy is developed and communicated to the organization. A policy 
statement should be issued to clearly reflect top management’s commitment to safety. The Safety Policy also 
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must indicate how safety management principles will be integrated into the organizational structure and 
define the procedures necessary for a successful SMS implementation. 


SAFETY POLICY 


e Policy Statement 


e Organizational 
Structure 


e Procedures 


Policy Statement 


The Safety Policy is a written document from senior management that is communicated to all employees. 
Other affiliated entities with a stake in organizational safety should also be informed. In an airport 
environment these might include airlines and other operators, local police, and concourse vendors. The 
Safety Policy should include the following: 


= Commitment to implementation of the SMS. SMS WILL ONLY BE 


™ Assurance that executives are monitoring safety performance just as keenly EFFECTIVE WHEN A 
as financial performance. 


Encouragement for all employees to report potential safety issues without ee ee 


fear of reprisal. DEVELOPED AND 


® Establishment of clear standards for acceptable behavior related to safety. COMMUNICATED TO 


= Commitment to providing the necessary resources. 
THE ORGANIZATION. 


Organizational Structure 


The Safety Policy also includes the organizational structure that will be relied upon to achieve and maintain 
the stated safety objectives. 


The organizational structure should be appropriate to the size, complexity, and operating environment of the 
organization. Large organizations may be best served by a formal SMS that utilizes a cross-functional Safety 
Committee, while smaller organizations may adequately perform the same functions with a more informal 
approach. 
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Regardless of the size of the organization, a Safety Manager should be designated as the focal point 
for implementation and maintenance of the SMS. While it is preferable for the Safety Manager to have no 
additional roles, this may not be possible in smaller organizations. In that case, the Safety Manager’s other 
responsibilities should not present a conflict of interest with safety management. The Safety Manager 
should be high enough in the organization to be able to communicate directly with top management. 


Procedures 


Safety procedures will lay out the process by which the organization identifies and remedies safety risks. They 
are subject to revision as circumstances change or more effective procedures are developed. It is critical that 
any changes be clearly communicated to all affected staff, and that the procedures be easily accessible to all 
for reference or continuing education purposes. 


Safety Promotion 


Safety Promotion is necessary to ensure that the entire organization fully understands and trusts the SMS 
policies, procedures, and structure. This pillar is achieved by establishing a culture of safety, training 
employees in safety principles, and allowing open communication of safety issues. 


SAFETY PROMOTION 


e Culture 


e Training 


e Communication 


Culture 


The main goal of safety promotion is to create a “safety culture” that allows the SMS to succeed. Having a 
safety culture means that all employees are responsible for safety. Such a culture is led by top management 
example, especially in the manner with which they deal with day-to-day activities. Employees must fully 
trust that they will have management support for decisions made in the interest of safety, while also 
recognizing that intentional breaches of safety will not be tolerated. The result is a non-punitive 
environment that encourages the identification, reporting, and correction of safety issues. 


Training 


In order to fulfill their responsibilities in an SMS-based organization, each employee must be trained in, or at least 
be aware of, safety principles. All personnel must understand the organization’s safety philosophy, policies, 


OVERVIEW OF SAFETY MANAGEMENT SYSTEMS FOR AIRPORTS 


procedures, and practices. They must also know their roles and responsibilities IN ADDITION TO 
within the safety management framework. The depth of the training should 


be appropriate to each individual’s position and vary from general safety WRITTEN 
familiarization to expert-level training for safety specialists. Recurrent training 
may also be necessary to keep personnel up to date on any changes to COMMUNICATIONS, 
SMS procedures. 

IT IS IMPORTANT 
Communication 

FOR EMPLOYEES 


Individual safety training is supplemented by an ongoing two-way communication 
process that helps ensure that employees benefit from safety lessons learned, see the TO WITNESS 
results of their actions, and continue to improve their understanding of the 
organization’s SMS. When new procedures are introduced, the associated underlying EVIDENCE OF THE 
safety analysis should also be communicated to the appropriate employees. In 
addition to written communications, it is important for employees to witness COMMITMENT OF 
evidence of the commitment of top management to safety. 
TOP MANAGEMENT 


Safety Risk Management TO SAFETY. 


Aviation is an activity that faces numerous risks on a daily basis. It is impossible to 

completely eliminate all risks; however, risk can be reduced to an acceptable level through Safety Risk 
Management (SRM) techniques. These consist of hazard identification, risk assessment, and risk mitigation 
and tracking. 


SAFETY RISK 
MANAGEMENT 


e Hazard Identification 


e Risk Assessment 


e Risk Mitigation and 
Tracking 


Hazard Identification 


The first step in Safety Risk Management is to identify hazards that the organization faces in its 
operational environment. A description of the system or operation that is going to be changed or 


e 
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implemented must be developed as part of this step in order to be able to identify what could go wrong. 
A hazard is any existing or potential condition that can lead to an accident or incident. In an SMS, all 
identified hazards are documented and analyzed to determine what action is required to eliminate or 
reduce the safety risk associated with the hazard. 


Identifying hazards is a key step to managing safety risk. 
Safety researcher James Reason has estimated that for each 
major accident there are as many as 360 incidents that might 
have identified an underlying problem in time to prevent the 
accident had they been properly reported and investigated. 


Risk Assessment 


Each identified hazard undergoes a risk assessment to determine its potential consequences. The assessment 
considers both the severity of the consequences and the probability of such an event occurring. A risk 
assessment matrix like the one shown in Figure 2.2 could be used in this analysis. The assessment may 
show that certain hazards have an acceptable level of risk, while others require mitigation. 


No Safety Hazardous | Catastrophic 
Effect 
Likelihood 5 
Frequent is 
A ag 
Probable |. 
B “ 
Remote | 
Cc 3 


Extremely 
Remote 
D 


Extremely 
Improbable 
E 


* Unacceptable with Single Point and 
Common Cause Failures 


Figure 2.2: Risk Assessment Matrix 
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Risk Mitigation and Tracking 


Mitigating actions should be fully analyzed to ensure that they address the root cause of the hazard. 
It may be beneficial to explore a range of mitigating strategies before choosing the preferred option, 
basing the decision upon factors such as timeliness, cost, organizational capabilities, and overall 
effectiveness. It is essential that management provide adequate resources to address the identified 
safety concerns. 


A system must be in place to determine logical approaches to counteract any risks to safe operation. This can 
be accomplished by reducing or eliminating a hazard’s likelihood of occurrence. Alternatively, a risk might 
be managed by reducing the severity of its effects. Occasionally, both may be possible. 


Finally, the mitigations that have been put in place must be monitored and tracked in order to ensure that the 
control strategies are working correctly. 
Safety Assurance 


Safety Assurance functions provide confidence that the organization is meeting or exceeding its safety 
objectives. The functions—internal audits, external audits, and corrective action—provide feedback on 
the performance of the organization, as well as the effectiveness of implemented risk mitigation 
strategies. 


SAFETY ASSURANCE 


e Internal Audits 


e External Audits 


e Corrective Action 


Internal Audits 


Internal audits are performed by each department within the organization to ensure that they are following 
the proper procedures and are achieving their safety objectives. These audits should be performed 

on a regular basis and may include surveys of employees and formal or informal inspections 

performed within a department. Both short- and long-term effectiveness of safety actions should 

be evaluated. 


10 
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External Audits 


External audits are conducted as part of the independent safety oversight of the organization. Audits can be 
scheduled or unscheduled and they provide a means for ensuring compliance with SMS standards, policies, 
and processes. For example, in a regulatory environment, the regulatory agency may conduct external 
audits. 


Corrective Action 


If an audit finds that prescribed procedures are not being followed, then corrective action should be taken by 
that department within the framework of Safety Assurance. Corrective action may also be taken to ensure that 
identified safety hazards are resolved. 


11 
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—e 


Section 3 


SMS in Other Industries and Aviation Segments 


System safety principles have been used in many industries other than aviation. The examples in this section 
summarize safety experiences in the petroleum, nuclear, railroad, marine, and chemical industries, as well as 
other segments of the aviation industry. They illustrate how past mishaps have led to the development and 
adoption of critical components of SMS. The evolution of system safety has been predicated on the need to 
avoid the injuries, loss of life, and financial consequences experienced by the entities highlighted here. 


Background 


Safety regulation of industry has traditionally been reactive and prescriptive. It generally occurs in response 
to a significant safety failure and only addresses the issues that directly led to the failure. Although this has 
led to an improved level of safety, the current rate of growth in the aviation industry in particular requires a 
more systematic approach. 


In fact, in today’s dynamic industries with increasingly complex production processes and high-volume 
operations, prescriptive regulations become less effective because they primarily seek to prevent the 
reoccurrence of failures. In many industries, prescriptive measures have been replaced by SMS processes, 
which are better suited for these dynamic systems. 


Lessons from Other Industries 
Petroleum Industry 


A good example of a change from prescriptive safety to an SMS approach can be found in the British 
offshore oil drilling industry. 


Piper Alpha Oil Rig, July 1988 
The Piper Alpha oil pumping station accounted for 10% of the UK’s North 
Sea oil production at its peak. It experienced a fire that caused 167 deaths, loss 
of oil production, and an insurance payout equivalent to $2.8 billion. The 
public inquiry found the management company directly responsible for a 
series of preventable failings and errors. The report recommended a change 
from a prescriptive safety system to a safety risk management approach based 
on Quantitative Risk Assessment. This approach assesses risk by determining 
the likelihood of an event and identifying the severity of the consequences. 
This is the basis of the Safety Risk Management pillar of SMS. 
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Nuclear Industry 


Safety has always been a primary concern in the nuclear industry. There have been two significant historical 
accidents: Three Mile Island in the United States and Chernoby] in the Ukraine. Both events have led to 
improvements in nuclear technology and the safety culture required to use it effectively. 


Three Mile Island, March 1979 
The nuclear plant’s reactor core was starved for coolant and about half of 
the fuel melted. Containment was not breached, and fortunately the accident 
did not cause any deaths. However, the cost for the cleanup was around 
$975 million and the reactor was permanently closed. The investigation 
called for a restructuring of the Nuclear Regulatory Commission with more 
emphasis on the agency’s responsibilities for reactor safety. In particular, it 
called for improving person-to-machine interfaces and risk assessment 
procedures. 


After this accident, the Nuclear Regulatory Commission increased its focus on a formal risk assessment 
approach, which has been the basis for many subsequent improvements in plant design and operation. 

In addition, changes were made in the area of control room operations, such as licensee training, program 
certification, and simplified procedures to mitigate a hazard. 


Chernobyl, April 1986 
A mismanaged electrical engineering experiment by the operators caused 
the reactor to lose its coolant. The reactor design was poor from a safety 
perspective, the operators were not aware that the test performed was 
potentially dangerous, and they did not comply with established operational 
procedures. There were 56 immediate deaths, and much more harm due to 
the release of radiation. According to investigators, the cause of the accident 
was the “lack of a safety culture.” 


After Chernobyl, remedial measures to enhance nuclear safety were implemented at existing plants with 
similar reactors. Safety upgrades essentially removed the design deficiencies that contributed to the 
accident. Progress was also achieved in plant management, training of personnel, non-destructive testing, 
and safety analysis. As a result, a repetition of the same accident scenario seems no longer practically 
possible. 


The new generation of nuclear plants is much safer, due in large part to the lessons learned from these industrial 
accidents. Several elements of today’s SMS were developed as a result, and the strict safety culture of today’s 
nuclear industry is an excellent model for other industries that perform high-risk operations. 
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Railway Industry 


In recent years, the railroad industry safety record has improved. However, from 1994 to 2005 train 
accidents increased from 3.67 to 4.09 per million train miles, leading to a mandate for adopting 
system safety measures. 


Graniteville, NC, January 2005 
A freight train traveling through Graniteville, NC, encountered an 
improperly laid switch that diverted the train onto an industry track 
where it struck a parked train. The collision derailed 16 cars of the 
moving train. One car was breached, releasing chlorine gas. Nine people 
died as a result of chlorine inhalation and total damage exceeded 
$69 million. The National Transportation Safety Board found that the 
probable cause of the accident was the failure of the crew of the parked 
train to return a main line switch to the normal position after the crew 
completed work at an industry track. 


An appropriations bill currently before Congress specifically calls for the establishment of a safety risk 
reduction program. The program shall “require each railroad to systematically evaluate safety risks, 
manage those risks and implement measures to eliminate or mitigate risks in its processes and procedures. 
The safety risk reduction program . . . requires different skills than the activities previously undertaken in 
the railroad safety program .. .” In this way, SMS will allow continued improvement in railway safety to 
avoid future accidents. 


Marine Industry 


Several maritime accidents in the 1980s and 1990s led to a push for a uniformly applicable formal safety 
management approach. 


Belgium, March 1987 
One of the most notable accidents was the Herald of Free Enterprise 
disaster—a car and passenger ferry that capsized. The Herald had doors at 
both the bow and stern, and due to operator negligence the bow doors had 
not been closed before leaving the harbor. 193 passengers were killed in 
the ensuing accident. A public inquiry was conducted, and the resulting 
report identified a “disease of sloppiness” and negligence at every level of 
the company’s hierarchy. 


In response, the International Maritime Organization adopted the International Management Code for the 
Safe Operation of Ships and for Pollution Prevention. This code “establishes safety management objectives 
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and requires SMS to be established by ‘The Company.’ ” The procedures required by the code should be 
documented and compiled in a Safety Management Manual, a copy of which should be kept on board. Such 
documentation of procedures is a cornerstone of SMS. 


Chemical Industry 


The chemical industry’s experience in SMS is exemplified by the DuPont Corporation. DuPont has been 
a leader in the implementation and promulgation of SMS for almost 200 years. Ever since an 1818 
explosion at its gunpowder mill in Delaware, industrial safety has been a major focus of the DuPont 
culture, and it has received many awards in the field. This promotion of system safety is the first 

pillar of SMS. 


DuPont has established a consulting branch, DuPont Safety Resources, to help other businesses and industries 
integrate safety management practices, including SRM, into all aspects and phases of their operations. For 
example, DuPont helped Qantas Airline establish a safety improvement program with the goal of “No 
Injuries to Anyone at Any Time.” Achievements at Qantas include a 50% reduction in lost work days, 

and $500 million in projected cost savings over 5 years. 


DuPont issues annual safety awards for individual and collective initiatives in Europe, the Middle 
East, and Africa for significant projects in workplace safety. The common thread among the 
winners is that they understand the strong link between creating a safer workplace and improved 
business performance. 


Aviation Industry 


Aviation safety is a fundamental mission of the FAA. The Federal Aviation Act of 1958 created the agency 
and charged it with establishing and operating the United States’ Air Traffic Control system in order to 
maintain a safe National Airspace System. In 2000, the FAA Administrator commissioned a team to 
study SMS. Management concluded that the design, development, and implementation of SMS are 
important next steps in aviation safety. 


Additionally, in November 2001, the International Civil Aviation Organization (ICAO) amended Annex 11 
to the Convention, Air Traffic Services, to require that member states establish an SMS for the provision of 
air traffic services. The SMS requirements described in Annex 11 are further detailed in ICAO Document 
4444, Procedures for Air Navigation Services, Air Traffic Management. 


While there were no specific aviation incidents that triggered the move toward SMS in the industry, there are 
several accidents in recent history that support the need for system safety, including some recent ones that are 
still being investigated. Two examples follow. 
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France, July 2000 
An Air France Concorde on a charter flight from Paris to JFK struck a 
16-inch strip of metal that was left behind by a previous departure. The 
Concorde’s left main landing gear was damaged and debris impacted the 
wing structure, which led to a rupture of the fuel tank. A major fire under 
the left wing broke out almost immediately, possibly ignited by electrical 
arcing due to debris damage and fueled by the leak. 113 people were killed 
in the ensuing crash, including four on the ground. A rigorous analysis of 
previous Concorde incidents involving burst tires and resulting debris 
might have provided insight into these structural vulnerabilities and sub- 
sequent remediation. The Safety Assurance pillar of SMS includes audits 
and corrective actions to ensure that procedures and materials are in place 
to pre-emptively mitigate a once-identified hazard. 


New Taxi Into Position and Hold (TIPH) Procedures 
Safety risk is increased any time an aircraft is holding on a runway and 
waiting for release under TIPH procedures. The recently announced TIPH 
procedures are designed to avoid hazardous situations that arise from last- 
minute arrival runway changes. This effort to lower safety risks associated 
with TIPH procedures was not triggered by one event or incident, but 
rather is due to continued efforts by the FAA to increase safety. Through 
the SMS Safety Risk Management (SRM) process, a panel reviewed TIPH 
operations across the National Airspace System and presented the new 
proposed procedures in an SMS-defined SRM document. The panel 
consisted of a staff controller; procedures experts; flight standards 
personnel; operational safety personnel; a technical operations interface 
expert; a safety engineer; and personnel from safety assurance, human 
factors, and FAA contract towers. 


While SMS will never be able to prevent all incidents and accidents, it does provide an approach that has 
already resulted in numerous improvements to aviation safety. It encourages proactive behavior that can help 
prevent mishaps that might have otherwise occurred. Many airlines and airports already have elements of 
SMS incorporated into their current organizational safety system. 
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Section 4 


ICAO Guidance for Airport SMS 


Background 


A global shift in airport management began in 1987 when the British Airports Authority was privatized. 

As airports continued to evolve from public utilities to businesses concerned with making a profit, the 
International Civil Aviation Organization (ICAO) took steps to promote safety management as a prerequisite 
for a sustainable aviation business. 


In 2000, the ICAO Air Navigation Commission commenced the process to amend Annex 14, Volume I, 
Aerodrome Design and Operations. New airport licensing and certification requirements called for the 
development and implementation of a safety management system. To address the lack of guidance material 
concerning SMS at airports, ICAO subsequently issued Standards and Recommended Practices (SARPs) for 
airport safety management systems. This section outlines the ICAO publications that regulate and guide SMS 
implementation in airport operations. Note that ICAO refers to airports as aerodromes, and uses “States” to 
refer to ICAO signatory countries. 


The following three ICAO references contain information pertaining to airport SMS: 


® Annex 14, Aerodromes, Volume I, Aerodrome Design and Operations, July 2004, Section 1.4, 
Certification of Aerodromes; Section 1.5, Safety Management 


= Document 9774, Manual on Certification of Aerodromes, First Edition, 2001 


a Safety Management Manual (SMM) 9859, First edition, 2006, Chapter 18, Aerodrome Operations 


Annex 14 


The SMS requirements in Volume I of Annex 14 became 
applicable in November 2005. The following are its key points: 


‘Cive Avation 


_ Aerodromes 


1 
Aeredioce Qetagn arc Opt wioas 
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& Aerodromes used for international operations shall be certified by 
States. As part of the process, States shall ensure that an 
aerodrome manual—which will include all pertinent information 
on organization and management, including a safety management 
system—is submitted for approval. 


& “States shall require, as part of their safety programme, that a 
certified aerodrome operator implements a safety management 
system accepted by the State that, as a minimum: 

— Identifies safety hazards 

— Ensures that remedial action necessary to maintain an 
acceptable level of safety is implemented 

— Provides for continuous monitoring and regular assessment of 
the safety level achieved 

— Aims to make continuous improvement to the overall level of 
safety” 


& “A safety management system shall clearly define lines of safety 
accountability throughout a certified aerodrome operator, 
including a direct accountability for safety on the part of senior 
management.” 


Manual on Certification of Aerodromes 


This document outlines SMS requirements and stipulates the following: 


= Implementation of SMS is essential for the certification of aerodrome 
operators 


m SMS is an integral part of the Aerodrome Operations Manual 


Manual on 


The SMS elements identified for inclusion in the Aerodrome Operations Certification 
_ of Aerodromes 


Manual are: 
m Safety policy 


® Structure of the organization 


= Individual and group responsibilities for safety issues 
= Setting of safety performance targets 


= Internal safety audit and review systems 
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Safety Management Manual, Chapter 18 


The Safety Management Manual can be found at 
http://www.icao.int/anb/safetymanagement/Documents.html. 


The chapter of the Safety Management Manual dealing with airports consists of four sections. 
They are outlined below. 


“Aerodrome Safety Management” describes: 
= Scope for aerodrome safety management 
= Aerodrome operator SMS 

= Safety manager and safety committee(s) 
™ Safety occurrence reporting 


m Safety oversight 


m Safety audits 
“Aerodrome Emergency Planning” includes: 


" Coordinated response—participation of those agencies which the aerodrome operator believes would be 
actively involved in an emergency 


m Aerodrome emergency exercises 

The “Aerodrome Apron Safety” section characterizes all facets of the apron, including: 
= Work environment 

= Accident causes 

m Safety management 

= Vehicle operations 


Finally, a section entitled “Role of Aerodrome Safety Managers in Ground Safety” focuses on how the Safety 
Manager might assess the adequacy of defenses against accidents on the airport surface. 


A sample Aerodrome Operator Safety Policy and a list of some factors contributing to hazards in the apron 
work environment are provided in the appendices (not published herein). 
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Section 5 


SMS Implementation at Airports Outside the 
United States 


SMS has only recently been implemented at airports around the world, so effectiveness data and 
lessons learned are still being collected. This section summarizes literature searches and interviews 
regarding SMS implementation with representatives of several non-U.S. airports, Civil Aviation 
Authorities (CAAs, the foreign version of the FAA), and ICAO. The information gathered for this 
document shows that there is wide variation in the way that SMS principles have been adopted 

and managed. 


Summaries of the individual interviews can be found at http://www.trb.org/news/blurb_detail.asp?id=79 18. 


Approaches to SMS Implementation 


A range of implementation styles have been undertaken by those airports practicing SMS today. This variety 
is due in part to the extent of customization required to suit the airport size and safety experience. Although 
most airports are new to SMS as outlined here, many have considerable experience with related system safety 
processes. These airports may require a less time-consuming transition. Implementation approaches can be 
grouped into one of the following categories: 


m Evolutionary style 


In this approach, an airport implements SMS principles over a period of several years. Over the 
course of this time, the safety culture gradually becomes ingrained in employees’ attitudes and 
actions. 


s Phased methodology 


This approach uses dates and milestones to implement the various aspects of SMS. It allows time to 
address any issues that arise before advancing to the next stage. 


“Fast Track’ adoption 


This style implements SMS at a relatively rapid pace. Although this approach may bring the airport into 
compliance with SMS regulations, it may not result in a sufficiently fundamental change in safety 
practices and attitudes. An aggressive employee training program will be required to achieve this sort of 
quick transition. 
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The CAAs interviewed tend to let airports institute safety management processes themselves using some or 
all of the following methods: 


Gathering best practices and lessons learned from more experienced organizations 
m Enlisting independent consultants or other airport operators to verify proposed safety programs 
= Compelling airports to initiate SMS self-education programs 


= Seeking software vendors to supply airport-specific data collection systems 


Process and Gap Analyses | IN A 2005 BERLIN 


Process analysis is generally the first step in SMS implementation. Not every UNIVERSITY OF 
airport has a complete understanding of all the processes and procedures that 
should be monitored as part of SMS—it is critical to “know what you don’t TECHNOLOGY STUDY 
know.” Once this initial identification step is complete, an airport can begin a 
gap analysis to determine where the safety deficiencies lie. This step may PERFORMED BY 
also reveal ways in which airport operations can be made more efficient. 

HENDRICK SCHORCHT, 
Data Collection 

APPROXIMATELY 1,600 
The backbone of any SMS is data collection and management. Many airport 
organizations possess an insufficient background in databases and other SAFETY-RELEVANT 
information system elements and may benefit from outside consultants for 
the development of this capability. Furthermore, safety data standardization AIRPORT OPERATIONS 


should be promoted across a CAA. 
PROCESSES WERE 


Hazard-Reporting Systems IDENTIFIED AND 


Voluntary and confidential incident-reporting programs are a cornerstone VERIFIED. 

of SMS. Some aviation organizations approach non-punitive reporting 

systems cautiously. There are several options for reporting safety hazards 

and potentially dangerous practices, including internally to the airport, to the CAA, or even to an 
NTSB-type entity. Some methods cut out the airport operator entirely in order to ensure protection for 
whistleblowers. The integrity of a hazard-reporting system is an important aspect of the safety culture that 
is developed under SMS practices. 


Benefits Identified 


The CAAs of Australia, Canada, Hong Kong, Ireland, Italy, Kuwait, Singapore, Switzerland, the United 
Kingdom, and elsewhere have identified SMS as the most effective system for ensuring that accident rates do 
not increase in correlation with the expected increase in global air traffic. Cardiff, Wales; Perth, Australia; 
Calgary, Canada; Copenhagen, Denmark; and Changi, Singapore are just a few of the airports that have 
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started to work toward improving their safety records using SMS principles. The following are some of the 
benefits of an airport SMS as identified by officials at these airports: 


= Achieving safer airport operations and compliance with regulations—SMS serves as an efficient means 
of dealing with regulators and legal systems 


Enhancing the ability to anticipate and address safety issues before they lead to an incident or 
accident 


Reducing the number and severity of collisions by focusing attention on safety needs that will result in a 
higher payback 


= Allowing the airport to prioritize issues that are most appropriate for its size and goals 

Maximizing the effect of safety investments by ensuring that the highest priority needs are identified 
Emphasizing process management and continuous improvement 

® Promoting a collaborative, stakeholder-focused approach to develop sound safety practices 

® Building a safety culture by increasing airport staff awareness of safety and risk 


™ Making staff more responsible for incident processing—assessment and management of incidents is more 
robust 


Formalizing processes and meetings 


SMS Lessons Learned at Airports Outside the United States 


Several interviewed airport officials in other countries shared their experiences implementing SMS. The 
following lessons learned were provided by respondents: 


™” Do not wait until legislation is in place — start the process now. 


& Some or much of what you have in place today can be used in an 


SMS framework. 


%* Documentation is the key SMS component to ensure and 


demonstrate an airport’s due diligence to requirements. 
Tackle SMS in stages, rather than trying to do everything at once. 
o* If not already done, establish and maintain a good working 


relationship with your partners and members of the airport 
community, including the regulator. 
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Critical Challenges 


Based on the interviews with airport authorities in other countries, the following aspects of SMS implementation 
were deemed both difficult and critical to success. They merit substantial research and planning. 


a 


Determining legal liability/accountability. 

Identifying a trained and qualified Safety Manager. 

Instituting data collection methodologies. 

Developing a workable non-punitive hazard-reporting system. 


Integrating airport SMS with other domains, particularly air traffic control and airlines. 


Summary of Airport Implementation Outside the United States 


It is widely recognized in the aviation community that safety is key to sustaining dynamic global economies. 
However, based on the experience of airport operators outside the United States, it takes more effort to enact 
significant change in airport environments than many realize. This is especially true if one desires to integrate 
safety management among the airline, air traffic control, and airport segments. There is no universal solution 
for improving airport safety, but SMS offers a customizable method that has been shown to work in various 
industries, including aviation. 
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Section 6 


Vision of SMS Implementation at U.S. Airports 


This document has described in a broad sense the benefits that SMS can provide to an airport organization. 
Incorporating SMS is not an overnight activity—managing safety to a level that is an improvement on 
today’s already remarkable system requires commitment and a thorough reevaluation of existing processes 
and procedures. This section describes the actions that are being undertaken by the FAA to attain the goal 
of SMS implementation at the airports certificated under 14 CFR Part 139, Certification of Airports. 
Furthermore, it suggests actions that an airport executive or manager might take to synchronize with 

the FAA initiatives. 


As previously mentioned, SMS is intended to build upon, not replace, existing safety processes. Many 
airports will likely have processes in place that go a long way toward developing an SMS. SMS integrates 
these processes and ensures that safety actions and processes are documented. 


FAA Activities 


There are number of activities that the Office of Airports has already undertaken or plans to commence. 
The first was issuing an Advisory Circular (AC) to introduce SMS. This AC can be found at 
http://www. faa.gov/airports_airtraffic/airports/resources/advisory_circulars/index.cfm?template=homepage. 
The FAA has selected a number of airports to participate in an SMS Pilot Study to develop SMS-based 
safety plans and learn from their experiences. The FAA Office of Airport Safety and Standards is also 
participating in an agency-wide initiative to implement SMS in all FAA organizations. Finally, a 
rulemaking project will be commenced in order to define the timeline and scope of SMS adoption 

at U.S. airports. 


Advisory Circular 


Advisory Circular AC 150/5200-37, Introduction to Safety Management Systems for Airport Operators was 
released on February 28, 2007. It states that the agency anticipates issuing a notice of proposed rulemaking 
for public comment in 2008. The Advisory Circular goes on to briefly define the four pillars of SMS and 
provides an example showing the application of SRM to improve safety during a runway construction 
project. 


SMS Pilot Study 


The FAA Office of Airport Safety and Standards has selected a number of airports of varying size for a study 
into how SMS might best be incorporated into airport processes and procedures. Participants will benefit 
from being an early adopter of a program that will likely be mandated in the future. Feedback from these 
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airports on implementation lessons learned will assist the FAA in providing future guidance to other airports 
developing elements of SMS. 


Participants will be responsible for developing and documenting SMS in a Safety Program Manual (SPM). It 
is the FAA’s intent to eventually incorporate SMS into the Airport Certification Manual. This Pilot Study will 
occur over the course of approximately 6 to 8 months, depending on airport size and complexity. It will 
consist of three phases as follows: 


= Phase 1: Gap Analysis 
= Phase 2: Development of Draft Safety Program Manual 
™ Phase 3: Development of Final Safety Program Manual 


One of the primary goals of the SMS Pilot Study is to identify the gaps between current airport regulations— 
as contained in 14 CFR 139 and associated FAA guidance material—and the intent of SMS. It is anticipated 
that there will be significant overlap between current safety plans and SMS principles. The findings of the 
Pilot Study will help FAA develop future guidance on SMS that will ultimately benefit the airports that 
subsequently implement SMS. 


Rulemaking 


The FAA supports harmonization of international standards and has worked to make U.S. aviation safety 
regulations consistent with ICAO standards and recommended practices. The agency intends to implement 
the use of SMS at U.S. airports to meet the intent of the ICAO standards in a way that complements existing 
FAA airport safety regulations. A decision on the final rule will take into account comments from industry 
and the public, as well as the experience of airports that have already implemented SMS. The AC also states 
that any decision to issue a final rule on SMS would: 
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“Consider the benefits and costs of the rule and tailor the rule to 
impose the minimum burden and costs necessary for effective 
implementation.” 


“Consider whether the requirement should apply to all certificated 
airports or only to airports above a certain activity level.” 


“Consider, for airports subject to an SMS requirement, how SMS 
program elements would apply to airports of different sizes and 
resources.” 


“Acknowledge the existing requirements of Part 139, and avoid 
duplication of safety programs.” 


“Consider the appropriate degree of FAA oversight of individual 
SMS plans by FAA airport certification safety inspectors.” 


“Review SMS training needs for FAA employees and airport 
operators.” 


ey 


Other Activities 


The Airport Cooperative Research Program of the Transportation Research Board is producing a Guidebook 
for Airport Safety Management Systems in coordination with the FAA. This task is expected to be completed 
in late 2008 and will be published as Volume 2 of this report. 


Airport Activities 


The following list should provide airport management with a general idea of the steps required to implement 
SMS in the entire organization. Although the rulemaking process is expected to take a couple years, there are 
some activities that airport operators can commence in the near term to prepare for the transition to the type 
of safety management systems that ICAO and the FAA have envisioned. 
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Steps to Establish an Airport SMS 


Establish a safety policy and assign safety responsibility 

Responsibility for overseeing the SMS implementation must be assigned at an early 
stage. At smaller airports, this may be an individual with other duties as well. For larger 
organizations, a team of safety professionals supporting a safety manager may prove 
more effective. The first task is establishing a safety policy that reflects SMS principles. 


Perform a gap analysis 

Compare existing safety components with SMS program requirements and 
identify all elements that require development. A gap analysis frequently 
begins with a list of all the current operations and procedures that occur at 
the airport. One can then verify whether they are performed in accordance 
with SMS philosophies. 


Develop a strategy for SMS implementation 

This is essentially a roadmap that lays out the steps required to 
fully implement SMS. The experience of other airports using 
SMS may prove helpful in determining an efficient phased 
approach and transition plan. 


Develop individual SMS elements 

Following the roadmap, the processes that make up 
SMS must be developed, documented, reviewed, 
and verified. 


At U.S. airports, many of the airport operators’ actions are governed by standards issued by the FAA. The 
FAA would not expect an airport operator to conduct an independent risk analysis of an action or condition 
directed by a mandatory FAA standard or specification. However, if the airport operator proposes to deviate 
from the standard, then risk analysis will likely still be required. 


Conclusions 


Aviation entities around the world—CAAs, airlines, and airports—will benefit from the adoption of SMS. 
Other industries have shown it to be an effective method for improving safety in the face of rapid growth 
and increasing technical complexity. It is hoped that this document will provide airport operators with a 
useful introduction to SMS and will help prepare them to transition to a safety management system that 
will enable them to systematically and proactively manage safety. 


30 


Abbreviations and acronyms used without definitions in TRB publications: 


AAAE American Association of Airport Executives 
AASHO American Association of State Highway Officials 
AASHTO American Association of State Highway and Transportation Officials 
ACI-NA Airports Council International—North America 
ACRP Airport Cooperative Research Program 

ADA Americans with Disabilities Act 

APTA American Public Transportation Association 

ASCE American Society of Civil Engineers 

ASME American Society of Mechanical Engineers 

ASTM American Society for Testing and Materials 

ATA Air Transport Association 

ATA American Trucking Associations 

CTAA Community Transportation Association of America 
CTBSSP Commercial Truck and Bus Safety Synthesis Program 
DHS Department of Homeland Security 

DOE Department of Energy 

EPA Environmental Protection Agency 

FAA Federal Aviation Administration 

FHWA Federal Highway Administration 

FMCSA Federal Motor Carrier Safety Administration 

FRA Federal Railroad Administration 

FTA Federal Transit Administration 

IEEE Institute of Electrical and Electronics Engineers 
ISTEA Intermodal Surface Transportation Efficiency Act of 1991 
ITE Institute of Transportation Engineers 

NASA National Aeronautics and Space Administration 
NASAO National Association of State Aviation Officials 
NCFRP National Cooperative Freight Research Program 
NCHRP National Cooperative Highway Research Program 
NHTSA National Highway Traffic Safety Administration 
NTSB National Transportation Safety Board 

SAE Society of Automotive Engineers 


SAFETEA-LU _ Safe, Accountable, Flexible, Efficient Transportation Equity Act: 
A Legacy for Users (2005) 


TCRP Transit Cooperative Research Program 

TEA-21 Transportation Equity Act for the 21st Century (1998) 
TRB Transportation Research Board 

TSA Transportation Security Administration 


U.S.DOT United States Department of Transportation 
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THE NATIONAL ACADEMIES" 


Advisers to the Nation on Science, Engineering, and Medicine 


The nation turns to the National Academies—National 
Academy of Sciences, National Academy of Engineering, 
Institute of Medicine, and National Research Council— 
for independent, objective advice on issues that affect 
people's lives worldwide. 

www.national-academies.org 
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